CheckPoint 156-215.71 問題集

質問 1：
You have detected a possible intruder listed in SmartView Tracker's active pane. What is the fastest method to block this intruder from accessing your network indefinitely?
A. In SmartView Tracker, select Tools / Block Intruder
B. In SmartDashbourd, select IPS / Network Security Denial of Service
C. In SmartView Monitor, select Tool / Suspicious Activity Rules.
D. Modify the Rule Base to drop these connections from the network.
正解：A

質問 2：
In a distributed management environment, the administrator has removed all default check boxes from the Policy / Global Properties / Firewall tab. In order for the Security Gateway to send logs to the Security Management Server, an explicit rule must be created to allow the Security Gateway to communicate to the Security Management Server on port ______.
A. 256
B. 259
C. 257
D. 900
正解：C

質問 3：
You want to configure a mail alert for every time the policy is installed to a specific Gateway. Where would you configure this alert?
A. In SmartView Monitor, select Gateway / Configure Thresholds.
B. In SmartDashboard, select Global Properties / Log and Alert Commands.
C. In SmartView Monitor, select Gateway / Configure Thresholds and in SmartDashboard select Global Properties / Log and Alerts / Alert Commands.
D. You cannot create a mail alert for Policy installation.
正解：C

質問 4：
Which of the following statements about service contracts, i.e., Certificate, software subscription, or support contract, is FALSE?
A. Most software-subscription contracts are permanent, and need not be renewed after a certain time passes.
B. A service contract can apply only for a single set of Security Gateways managed by the same Security Management Server.
C. The contract file is stored on the Security Management Server and downloaded to all Security Gateways during the upgrade process.
D. Service Contracts can apply for an entire User Center account.
正解：A

質問 5：
You issue the fw monitor command with no arguments. Which of the following inspection points will be displayed?
A. Before the virtual machine, in the inbound direction
B. All inspection points
C. After the virtual machine, in the outbound direction
D. Before the virtual machine, in the outbound direction
正解：B

質問 6：
You have configured Automatic Static NAT on an internal host-node object. You clear the box Translate destination on client site from Global Properties / NAT. Assuming all other NAT settings in Global Properties are selected, what else must be configured so that a host on the Internet can initiate an inbound connection to this host?
A. The NAT IP address must be added to the anti-spoofing group of the external gateway interface
B. No extra configuration is needed
C. A static route, to ensure packets destined for the public NAT IP address will reach the Gateway's internal interface.
D. A proxy ARP entry, to ensure packets destined for the public IP address will reach the Security Gateway's external interface.
正解：C

質問 7：
The fw monitor utility is used to troubleshoot which of the following problems?
A. Phase two key negotiation
B. Log Consolidation Engine
C. User data base corruption
D. Address translation
正解：D

質問 8：
For VPN routing to succeed, what must be configured?
A. VPN routing is not configured in the Rule Base or Community objects. Only the native-routing mechanism on each Gateway can direct the traffic via its VTI configured interfaces.
B. A single rule in the Rule Base must cover all traffic on the central (HUB) Security Gateway for the VPN domain.
C. No rules need to be created; implied rules that cover inbound and outbound traffic on the central (HUB) Gateway are already in place from Policy > Properties > Accept VPN-1 Control Connections.
D. At least two rules in the Rule Base must be created, one to cover traffic inbound and the other to cover traffic outbound on the central (HUB) Security Gateway.
正解：B